Your credit card details can be seen as public
Your credit card details have been handled in an insecure way, and you should contact your bank to have the card revoked and get a new one.
What have happened
To handle credit card payments over Internet the company need to be PCI-DSS certified (thanks David Fulton for the full certification name). The certification is mandatory by the big credit card companies like Visa and MasterCard. This certification is in place to make sure the credit card details are handled in a secure way.
But a webshop doesn't need this certification if they use a third party payment provider. In that case all credit card information is handled by the payment provider. By sending the credit card information directly to the payment provider the webshop never handle any credit card information at all.
The webshop you have ordered from doesn't have, or doesn't follow, the PCI-DSS certification. This is obvious by them asking for the CVV by email. And they don't use a third party payment provider that have the PCI-DSS certification, by the same evidence. At least not in the intended way. Most likely they are trying to develop at least the UI for the payment without fully knowing what they do.
The result of this is that the credit card details added to this webshop can't be trusted. They have showed that they can't handle the security needed for credit card data. As such I would treat all information for that webshop as public.
Please note that I'm not saying that the webshop have acted knowingly maliciously. But it's about your money, does it really matter if it's knowingly or not?
What to do now
I can't tell you what to do, but this is what I would do:
- Contact the bank and stop the payment for this order. I don't want to make business with dodgy companies, I would rather order the product elsewhere for a few bucks extra.
- When talking to the bank, cancel the card and order a new one. A new one with a new credit card number. As stated above I consider your credit card details to be public. And since you know it's been used a bit dodgy, you probably won't get the money back if it's used for something you haven't ordered.
- Contact the webshop and cancel the order. Do this as soon as possible, after stopping the transaction and cancelling the card.
- Contact your credit card company (Visa, MasterCard etc) and report the webshop to them. Hopefully they will investigate the webshop. That way you help making sure no one else gets into this mess.
Could it be something else
As stated in other answers this could be phishing. But if it is, shouldn't the order be completed by now? And how did the phishers know you placed an order in that webshop? If you made it public on the Internet it could be they have picked it up from there, otherwise they got the information from the webshop.
But again, it's your money on the line. I think it's better to be safe than sorry.